The Essential Cybersecurity Controls are the baseline every regulated organisation in the Kingdom is measured against. Here is what they ask for and how to get there without drowning in paperwork.
The National Cybersecurity Authority (NCA) published the Essential Cybersecurity Controls, usually shortened to ECC, in 2018 and released an updated edition, ECC-2:2024. The idea behind them is simple. Instead of every government body and critical operator inventing its own definition of "secure enough", the Kingdom has one minimum standard, and the NCA can check organisations against it.
That simplicity hides a lot of work. ECC touches governance, technology, people and suppliers, and an assessor will want evidence for each control rather than a policy that says the right things. This guide walks through who the controls apply to, what they cover, and a practical order for tackling them.
Who has to comply
ECC applies to government organisations in Saudi Arabia, including ministries, authorities and public establishments, along with the companies and entities they own. It also applies to private sector organisations that own, operate or host critical national infrastructure.
The reach goes further in practice. If you supply services to an in-scope organisation, especially IT, hosting or managed services, expect your contracts and tender documents to ask how you align with ECC. Many private companies outside the formal scope also adopt it voluntarily, because it gives a recognised, local benchmark that boards and customers understand.
ECC is also the foundation for the NCA's more specialised controls. Depending on what you run, you may need to look at the Cloud Cybersecurity Controls, the Critical Systems Cybersecurity Controls, the Data Cybersecurity Controls, the Operational Technology Cybersecurity Controls, the Telework Cybersecurity Controls or the Organizational Social Media Cybersecurity Controls. Work out early which of these apply, so you design one programme rather than six.
What the controls cover
The controls are grouped into main domains, each broken into subdomains and individual controls. You do not need to memorise the numbering, but it helps to understand the shape.
Governance
This is where most organisations underestimate the effort. ECC expects an approved cybersecurity strategy, a dedicated cybersecurity function, documented policies and procedures, defined roles and responsibilities, a risk management methodology, cybersecurity in project and change management, periodic compliance reviews, HR security across the employee lifecycle, and an ongoing awareness and training programme.
Defence
The technical core: asset management, identity and access management, protection of systems and processing facilities, email, network and mobile device security, data and information protection, cryptography, backup and recovery, vulnerability management, penetration testing, event logging and monitoring, incident and threat management, physical security and web application security.
Resilience
Cybersecurity has to be part of business continuity management, so that your continuity plans account for cyber incidents and not only power cuts and floods.
Third parties and cloud
Security requirements must flow into supplier contracts and be checked, and cloud use needs its own controls, including attention to where data is hosted.
The requirements that catch people out
A few controls generate most of the difficult conversations we have with clients.
- An independent cybersecurity function. ECC expects cybersecurity to sit apart from the IT department, reporting to the head of the organisation or a delegate, so that the people running systems are not the only ones judging whether those systems are secure.
- Saudi leadership of the function. The head of cybersecurity and other critical cybersecurity roles are expected to be filled by full-time, qualified Saudi professionals. Plan recruitment and succession with that in mind.
- Evidence, not intent. A policy that says "access is reviewed quarterly" is a liability if nobody can show the last three reviews.
- Periodic review. Compliance is checked again, so a one-off project that is never maintained will fail the next assessment.
A practical roadmap
Every organisation starts from a different place, but the order below avoids the most common waste: writing documents for controls you have not yet designed, or buying tools before you know what gap they close.
- Confirm scope. Decide which entities, systems and locations are in scope, and which other NCA control sets apply alongside ECC.
- Run a gap assessment. Go control by control and record three things: the current state, the evidence that proves it, and the gap. Interview the people who actually operate the controls, not just their managers.
- Prioritise by risk. Some gaps are urgent and cheap to close, such as multi-factor authentication on remote access, an accurate asset inventory, and central logging for critical systems. Do those first. Others, such as a mature third-party programme, take longer and should be planned.
- Fix governance early. Get the strategy, the function and the core policies approved. Without them, every technical improvement lacks an owner and a mandate.
- Implement and operate the controls. Configure, monitor and review. Build the routine tasks, such as access reviews, vulnerability scans and backup restore tests, into a calendar with named owners.
- Assemble an evidence library. For each control, keep the current policy, the procedure, and dated records showing it working. Store them where an assessor can be walked through them in an afternoon.
- Monitor continuously. Controls drift as systems change and people move on. A quarterly internal review catches the drift before the regulator does.
Mistakes we see repeatedly
Treating ECC as a documentation project. Policies downloaded from a template and approved in one meeting look tidy until someone asks how they are applied. Write fewer documents, and make sure each one describes what actually happens.
Skipping the asset inventory. Nearly every defence control depends on knowing what you own. If your inventory is a spreadsheet last updated two years ago, fix that before anything else.
Forgetting suppliers. Your managed service provider, your payroll platform and your outsourced developers all hold access or data. ECC expects security requirements in those contracts, and an attacker will happily use the weakest one.
Scattered evidence. Screenshots in email threads and exports on someone's laptop cost days during an assessment. Decide on one place and one naming convention from day one.
How long it takes
It depends on your starting point and size. A mid-sized organisation with some security basics in place but little formal governance should think in terms of a programme measured in months, with the governance work and the first wave of technical fixes running in parallel. The organisations that move fastest are the ones that give a single owner the authority to make decisions and keep the gap register honest.
If you want a quick view of where you stand before committing to a full gap assessment, our free maturity assessment covers twenty of the areas that matter most under ECC and the NIST framework, and takes about five minutes.